A New Botnet Is Hijacking Forgotten Routers and IoT Gear: Check Yours
Here is your Saturday security read, and it is a quiet one: the device most likely to let an attacker into your business is often the one nobody has logged into in years.
Researchers at Fortinet's FortiGuard Labs have detailed a new Linux backdoor they have named ClingSTUN, and it is a tidy illustration of how most small businesses actually get compromised. Rather than chase a flashy zero-day, ClingSTUN spreads by exploiting a list of more than two dozen known vulnerabilities, many of them years old, in internet-facing routers, DVRs, IoT gadgets and VPN appliances from brands like D-Link, TP-Link, Realtek, Linksys and Ivanti. Once it is in, it quietly turns the device into a proxy node for someone else's traffic. The full technical write-up is over at Infosecurity Magazine.
The clever part is how it stays hidden. ClingSTUN does not phone home to an obvious command server. It abuses public STUN servers, the same infrastructure your VoIP phones and video calls rely on, so its traffic blends in with normal business activity.
Why this matters for Australian small businesses
For a small business, that is the whole problem in a nutshell. The risk is not always the laptop you use every day, it is the gear you have stopped thinking about. In the network reviews we run for clients across Sydney's Northern Beaches and out in Central West NSW, the device that trips people up is almost always the oldest one still doing a job: a modem-router the previous provider left behind, a security recorder nobody has logged into since install, a NAS humming away in a cupboard. Nobody owns it, so nobody patches it.
"The device most likely to let an attacker in is usually the one nobody remembers owning."
Dan Briggs, All IT ServicesWhat to check this Cyber Security Action Month
October is Cyber Security Action Month here in Australia, which makes it the perfect excuse to do the unglamorous work. It does not take long, and it is one of the highest-value hours a small business can spend on security all year.
- Inventory everything. List every device that touches the internet: modems, firewalls, cameras, printers, door controllers, the lot.
- Check for firmware updates. Apply them, and prioritise anything with a known flaw that is being actively exploited.
- Retire what is past it. Replace any device that has reached end-of-life and no longer receives security updates.
- Segment what you cannot replace. Put older gear on its own network so it cannot reach the rest of your systems.
Cyber Security Action Month, Australian Cyber Security Centre
Frequently Asked Questions
What is the ClingSTUN botnet?
ClingSTUN is a Linux backdoor identified by Fortinet's FortiGuard Labs in October 2026. It spreads by exploiting known, unpatched vulnerabilities in internet-facing devices such as routers, DVRs, IoT gear and VPN appliances, then turns them into remotely controlled proxy nodes. It is unusual because it has no dedicated command server. Instead it abuses public STUN servers, the same infrastructure used by VoIP and video calls, to stay hidden.
Which devices are most at risk?
FortiGuard's tracked list covers more than 24 vulnerabilities across devices from vendors including D-Link, TP-Link, Realtek, Linksys and Ivanti, plus various DVR and IoT cloud platforms. Many of the flaws are years old. The common thread is devices that are internet-facing, rarely updated and rarely monitored: the modem-router, security recorder or old firewall nobody has logged into since it was installed.
How would I know if a device on my network is infected?
It is deliberately hard to spot, because the malware's traffic looks like normal VoIP or WebRTC activity. Watch for devices making unexpected outbound UDP connections, recurring keepalive traffic to unfamiliar servers, or gear running hot or rebooting oddly. For most small businesses the more practical move is to inventory what is connected and check whether each device is still supported and patched, rather than trying to hunt the malware directly.
What should a small business do first?
Make a list of every internet-facing device on your network, check each one for firmware updates, and prioritise anything with a known, actively exploited flaw. Replace or isolate devices that no longer receive security updates. If you are not sure what is connected or what is still supported, that inventory is exactly the kind of thing a managed IT provider can run for you.
Not sure what is sitting on your network?
All IT Services helps Australian businesses find the forgotten devices, keep them patched, and lock down the ones that cannot be. A quick network review now beats a breach later.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →